[libvirt-9.10.0] Adding SEV SNP in Dom capabilities. · Pull Request !328 · openEuler/libvirt

1.      qemu_monitor_json: Report error in error paths in SEV related code
2.	conf: Move some members of virDomainSEVDef into virDomainSEVCommonDef
3.	conf: Drop needless NULL checks guarding virBufferEscapeString()
4.	conf: Separate SEV formatting into a function
5.	Drop needless typecast to virDomainLaunchSecurity
6.	src: Convert some _virDomainSecDef::sectype checks to switch()
7.	qemu_monitor: Allow querying SEV-SNP state in 'query-sev'
8.	qemu: Report snp-policy in virDomainGetLaunchSecurityInfo()
9.	qemu: capabilities: Introduce QEMU_CAPS_VIRTIO_BLK_IOTHREAD_MAPPING
10.	qemu_capabilities: Introduce QEMU_CAPS_SEV_SNP_GUEST
11.	conf: Introduce SEV-SNP support
12.	qemu: Build cmd line for SEV-SNP
13.	qemu_firmware: Pick the right firmware for SEV-SNP guests
14.	domcaps: Report launchSecurity
15.	qemu: Fill launchSecurity in domaincaps
16.     domain_validate: Add missing 'break' in virDomainDefLaunchSecurityValidate()

**Testing** 
     **Without Patches**
```bash
$ virsh domcapabilities
<domainCapabilities>
  <path>/usr/libexec/qemu-kvm</path>
  <domain>kvm</domain>
  <machine>pc-i440fx-8.2</machine>
  <arch>x86_64</arch>
  <vcpu max='255'/>
  <iothreads supported='yes'/>
  <os supported='yes'>
    <enum name='firmware'/>
    <loader supported='yes'>
      <enum name='type'>
        <value>rom</value>
        <value>pflash</value>
      </enum>
      <enum name='readonly'>
        <value>yes</value>
        <value>no</value>
      </enum>
      <enum name='secure'>
        <value>no</value>
      </enum>
    </loader>
  </os>
  <cpu>
    <mode name='host-passthrough' supported='yes'>
      <enum name='hostPassthroughMigratable'>
        <value>on</value>
        <value>off</value>
      </enum>
    </mode>
    <mode name='maximum' supported='yes'>
      <enum name='maximumMigratable'>
        <value>on</value>
        <value>off</value>
      </enum>
    </mode>
    <mode name='host-model' supported='yes'>
      <model fallback='forbid'>EPYC-Genoa</model>
      <vendor>AMD</vendor>
      <maxphysaddr mode='passthrough' limit='46'/>
      <feature policy='require' name='x2apic'/>
      <feature policy='require' name='tsc-deadline'/>
      <feature policy='require' name='hypervisor'/>
      <feature policy='require' name='tsc_adjust'/>
      <feature policy='require' name='movdiri'/>
      <feature policy='require' name='movdir64b'/>
      <feature policy='require' name='avx512-vp2intersect'/>
      <feature policy='require' name='spec-ctrl'/>
      <feature policy='require' name='stibp'/>
      <feature policy='require' name='flush-l1d'/>
      <feature policy='require' name='arch-capabilities'/>
      <feature policy='require' name='ssbd'/>
      <feature policy='require' name='avx-vnni'/>
      <feature policy='require' name='cmp_legacy'/>
      <feature policy='require' name='invtsc'/>
      <feature policy='require' name='virt-ssbd'/>
      <feature policy='require' name='lbrv'/>
      <feature policy='require' name='tsc-scale'/>
      <feature policy='require' name='vmcb-clean'/>
      <feature policy='require' name='pause-filter'/>
      <feature policy='require' name='pfthreshold'/>
      <feature policy='require' name='v-vmsave-vmload'/>
      <feature policy='require' name='vgif'/>
      <feature policy='require' name='rdctl-no'/>
      <feature policy='require' name='skip-l1dfl-vmentry'/>
      <feature policy='require' name='mds-no'/>
      <feature policy='require' name='pschange-mc-no'/>
      <feature policy='require' name='gds-no'/>
    </mode>
    <mode name='custom' supported='yes'>
      <model usable='yes' vendor='unknown'>qemu64</model>
      <model usable='yes' vendor='unknown'>qemu32</model>
      <model usable='no' vendor='AMD'>phenom</model>
      <model usable='yes' vendor='unknown'>pentium3</model>
      <model usable='yes' vendor='unknown'>pentium2</model>
      <model usable='yes' vendor='unknown'>pentium</model>
      <model usable='no' vendor='Intel'>n270</model>
      <model usable='yes' vendor='unknown'>kvm64</model>
      <model usable='yes' vendor='unknown'>kvm32</model>
      <model usable='no' vendor='Intel'>coreduo</model>
      <model usable='no' vendor='Intel'>core2duo</model>
      <model usable='no' vendor='AMD'>athlon</model>
      <model usable='yes' vendor='Intel'>Westmere-IBRS</model>
      <model usable='yes' vendor='Intel'>Westmere</model>
      <model usable='no' vendor='Intel'>Snowridge</model>
      <model usable='yes' vendor='Intel'>Skylake-Server-noTSX-IBRS</model>
      <model usable='no' vendor='Intel'>Skylake-Server-IBRS</model>
      <model usable='no' vendor='Intel'>Skylake-Server</model>
      <model usable='yes' vendor='Intel'>Skylake-Client-noTSX-IBRS</model>
      <model usable='no' vendor='Intel'>Skylake-Client-IBRS</model>
      <model usable='no' vendor='Intel'>Skylake-Client</model>
      <model usable='no' vendor='Intel'>SapphireRapids</model>
      <model usable='yes' vendor='Intel'>SandyBridge-IBRS</model>
      <model usable='yes' vendor='Intel'>SandyBridge</model>
      <model usable='yes' vendor='Intel'>Penryn</model>
      <model usable='no' vendor='AMD'>Opteron_G5</model>
      <model usable='no' vendor='AMD'>Opteron_G4</model>
      <model usable='yes' vendor='AMD'>Opteron_G3</model>
      <model usable='yes' vendor='AMD'>Opteron_G2</model>
      <model usable='yes' vendor='AMD'>Opteron_G1</model>
      <model usable='yes' vendor='Intel'>Nehalem-IBRS</model>
      <model usable='yes' vendor='Intel'>Nehalem</model>
      <model usable='yes' vendor='Intel'>IvyBridge-IBRS</model>
      <model usable='yes' vendor='Intel'>IvyBridge</model>
      <model usable='yes' vendor='Intel'>Icelake-Server-noTSX</model>
      <model usable='no' vendor='Intel'>Icelake-Server</model>
      <model usable='yes' vendor='Intel'>Haswell-noTSX-IBRS</model>
      <model usable='yes' vendor='Intel'>Haswell-noTSX</model>
      <model usable='no' vendor='Intel'>Haswell-IBRS</model>
      <model usable='no' vendor='Intel'>Haswell</model>
      <model usable='yes' vendor='AMD'>EPYC-Rome</model>
      <model usable='yes' vendor='AMD'>EPYC-Milan</model>
      <model usable='yes' vendor='AMD'>EPYC-IBPB</model>
      <model usable='yes' vendor='AMD'>EPYC-Genoa</model>
      <model usable='yes' vendor='AMD'>EPYC</model>
      <model usable='yes' vendor='Hygon'>Dhyana</model>
      <model usable='no' vendor='Intel'>Cooperlake</model>
      <model usable='yes' vendor='Intel'>Conroe</model>
      <model usable='no' vendor='Intel'>Cascadelake-Server-noTSX</model>
      <model usable='no' vendor='Intel'>Cascadelake-Server</model>
      <model usable='yes' vendor='Intel'>Broadwell-noTSX-IBRS</model>
      <model usable='yes' vendor='Intel'>Broadwell-noTSX</model>
      <model usable='no' vendor='Intel'>Broadwell-IBRS</model>
      <model usable='no' vendor='Intel'>Broadwell</model>
      <model usable='yes' vendor='unknown'>486</model>
    </mode>
  </cpu>
  <memoryBacking supported='yes'>
    <enum name='sourceType'>
      <value>file</value>
      <value>anonymous</value>
      <value>memfd</value>
    </enum>
  </memoryBacking>
  <devices>
    <disk supported='yes'>
      <enum name='diskDevice'>
        <value>disk</value>
        <value>cdrom</value>
        <value>floppy</value>
        <value>lun</value>
      </enum>
      <enum name='bus'>
        <value>ide</value>
        <value>fdc</value>
        <value>scsi</value>
        <value>virtio</value>
        <value>usb</value>
        <value>sata</value>
      </enum>
      <enum name='model'>
        <value>virtio</value>
        <value>virtio-transitional</value>
        <value>virtio-non-transitional</value>
      </enum>
    </disk>
    <graphics supported='yes'>
      <enum name='type'>
        <value>vnc</value>
        <value>egl-headless</value>
        <value>dbus</value>
      </enum>
    </graphics>
    <video supported='yes'>
      <enum name='modelType'>
        <value>vga</value>
        <value>cirrus</value>
        <value>vmvga</value>
        <value>virtio</value>
        <value>none</value>
        <value>bochs</value>
        <value>ramfb</value>
      </enum>
    </video>
    <hostdev supported='yes'>
      <enum name='mode'>
        <value>subsystem</value>
      </enum>
      <enum name='startupPolicy'>
        <value>default</value>
        <value>mandatory</value>
        <value>requisite</value>
        <value>optional</value>
      </enum>
      <enum name='subsysType'>
        <value>usb</value>
        <value>pci</value>
        <value>scsi</value>
      </enum>
      <enum name='capsType'/>
      <enum name='pciBackend'>
        <value>default</value>
        <value>vfio</value>
      </enum>
    </hostdev>
    <rng supported='yes'>
      <enum name='model'>
        <value>virtio</value>
        <value>virtio-transitional</value>
        <value>virtio-non-transitional</value>
      </enum>
      <enum name='backendModel'>
        <value>random</value>
        <value>egd</value>
        <value>builtin</value>
      </enum>
    </rng>
    <filesystem supported='yes'>
      <enum name='driverType'>
        <value>path</value>
        <value>handle</value>
        <value>virtiofs</value>
      </enum>
    </filesystem>
    <tpm supported='yes'>
      <enum name='model'>
        <value>tpm-tis</value>
        <value>tpm-crb</value>
      </enum>
      <enum name='backendModel'>
        <value>passthrough</value>
        <value>emulator</value>
        <value>external</value>
      </enum>
      <enum name='backendVersion'>
        <value>1.2</value>
        <value>2.0</value>
      </enum>
    </tpm>
    <redirdev supported='no'/>
    <channel supported='yes'>
      <enum name='type'>
        <value>pty</value>
        <value>unix</value>
      </enum>
    </channel>
    <crypto supported='yes'>
      <enum name='model'>
        <value>virtio</value>
      </enum>
      <enum name='type'>
        <value>qemu</value>
      </enum>
      <enum name='backendModel'>
        <value>builtin</value>
        <value>lkcf</value>
      </enum>
    </crypto>
  </devices>
  <features>
    <gic supported='no'/>
    <vmcoreinfo supported='yes'/>
    <genid supported='yes'/>
    <backingStoreInput supported='yes'/>
    <backup supported='yes'/>
    <async-teardown supported='yes'/>
    <sev supported='no'/>
    <sgx supported='no'/>
    <hyperv supported='yes'>
      <enum name='features'>
        <value>relaxed</value>
        <value>vapic</value>
        <value>spinlocks</value>
        <value>vpindex</value>
        <value>runtime</value>
        <value>synic</value>
        <value>stimer</value>
        <value>reset</value>
        <value>vendor_id</value>
        <value>frequencies</value>
        <value>reenlightenment</value>
        <value>tlbflush</value>
        <value>ipi</value>
        <value>avic</value>
      </enum>
    </hyperv>
  </features>
</domainCapabilities>

```
     **With Patches**

```bash
 $ virsh domcapabilities
<domainCapabilities>
  <path>/usr/local/bin/qemu-system-x86_64</path>
  <domain>kvm</domain>
  <machine>pc-i440fx-9.1</machine>
  <arch>x86_64</arch>
  <vcpu max='255'/>
  <iothreads supported='yes'/>
  <os supported='yes'>
    <enum name='firmware'>
      <value>efi</value>
    </enum>
    <loader supported='yes'>
      <value>/usr/local/share/qemu/edk2-x86_64-code.fd</value>
      <enum name='type'>
        <value>rom</value>
        <value>pflash</value>
      </enum>
      <enum name='readonly'>
        <value>yes</value>
        <value>no</value>
      </enum>
      <enum name='secure'>
        <value>no</value>
      </enum>
    </loader>
  </os>
  <cpu>
    <mode name='host-passthrough' supported='yes'>
      <enum name='hostPassthroughMigratable'>
        <value>on</value>
        <value>off</value>
      </enum>
    </mode>
    <mode name='maximum' supported='yes'>
      <enum name='maximumMigratable'>
        <value>on</value>
        <value>off</value>
      </enum>
    </mode>
    <mode name='host-model' supported='yes'>
      <model fallback='forbid'>EPYC-Genoa</model>
      <vendor>AMD</vendor>
      <maxphysaddr mode='passthrough' limit='46'/>
      <feature policy='require' name='x2apic'/>
      <feature policy='require' name='tsc-deadline'/>
      <feature policy='require' name='hypervisor'/>
      <feature policy='require' name='tsc_adjust'/>
      <feature policy='require' name='movdiri'/>
      <feature policy='require' name='movdir64b'/>
      <feature policy='require' name='avx512-vp2intersect'/>
      <feature policy='require' name='spec-ctrl'/>
      <feature policy='require' name='stibp'/>
      <feature policy='require' name='flush-l1d'/>
      <feature policy='require' name='arch-capabilities'/>
      <feature policy='require' name='ssbd'/>
      <feature policy='require' name='avx-vnni'/>
      <feature policy='require' name='cmp_legacy'/>
      <feature policy='require' name='invtsc'/>
      <feature policy='require' name='virt-ssbd'/>
      <feature policy='require' name='lbrv'/>
      <feature policy='require' name='tsc-scale'/>
      <feature policy='require' name='vmcb-clean'/>
      <feature policy='require' name='pause-filter'/>
      <feature policy='require' name='pfthreshold'/>
      <feature policy='require' name='v-vmsave-vmload'/>
      <feature policy='require' name='vgif'/>
      <feature policy='require' name='rdctl-no'/>
      <feature policy='require' name='skip-l1dfl-vmentry'/>
      <feature policy='require' name='mds-no'/>
      <feature policy='require' name='pschange-mc-no'/>
      <feature policy='require' name='gds-no'/>
    </mode>
    <mode name='custom' supported='yes'>
      <model usable='yes' vendor='unknown'>qemu64</model>
      <model usable='yes' vendor='unknown'>qemu32</model>
      <model usable='no' vendor='AMD'>phenom</model>
      <model usable='yes' vendor='unknown'>pentium3</model>
      <model usable='yes' vendor='unknown'>pentium2</model>
      <model usable='yes' vendor='unknown'>pentium</model>
      <model usable='no' vendor='Intel'>n270</model>
      <model usable='yes' vendor='unknown'>kvm64</model>
      <model usable='yes' vendor='unknown'>kvm32</model>
      <model usable='no' vendor='Intel'>coreduo</model>
      <model usable='no' vendor='Intel'>core2duo</model>
      <model usable='no' vendor='AMD'>athlon</model>
      <model usable='yes' vendor='Intel'>Westmere-IBRS</model>
      <model usable='yes' vendor='Intel'>Westmere</model>
      <model usable='no' vendor='Intel'>Snowridge</model>
      <model usable='yes' vendor='Intel'>Skylake-Server-noTSX-IBRS</model>
      <model usable='no' vendor='Intel'>Skylake-Server-IBRS</model>
      <model usable='no' vendor='Intel'>Skylake-Server</model>
      <model usable='yes' vendor='Intel'>Skylake-Client-noTSX-IBRS</model>
      <model usable='no' vendor='Intel'>Skylake-Client-IBRS</model>
      <model usable='no' vendor='Intel'>Skylake-Client</model>
      <model usable='no' vendor='Intel'>SapphireRapids</model>
      <model usable='yes' vendor='Intel'>SandyBridge-IBRS</model>
      <model usable='yes' vendor='Intel'>SandyBridge</model>
      <model usable='yes' vendor='Intel'>Penryn</model>
      <model usable='no' vendor='AMD'>Opteron_G5</model>
      <model usable='no' vendor='AMD'>Opteron_G4</model>
      <model usable='yes' vendor='AMD'>Opteron_G3</model>
      <model usable='yes' vendor='AMD'>Opteron_G2</model>
      <model usable='yes' vendor='AMD'>Opteron_G1</model>
      <model usable='yes' vendor='Intel'>Nehalem-IBRS</model>
      <model usable='yes' vendor='Intel'>Nehalem</model>
      <model usable='yes' vendor='Intel'>IvyBridge-IBRS</model>
      <model usable='yes' vendor='Intel'>IvyBridge</model>
      <model usable='yes' vendor='Intel'>Icelake-Server-noTSX</model>
      <model usable='no' vendor='Intel'>Icelake-Server</model>
      <model usable='yes' vendor='Intel'>Haswell-noTSX-IBRS</model>
      <model usable='yes' vendor='Intel'>Haswell-noTSX</model>
      <model usable='no' vendor='Intel'>Haswell-IBRS</model>
      <model usable='no' vendor='Intel'>Haswell</model>
      <model usable='yes' vendor='AMD'>EPYC-Rome</model>
      <model usable='yes' vendor='AMD'>EPYC-Milan</model>
      <model usable='yes' vendor='AMD'>EPYC-IBPB</model>
      <model usable='yes' vendor='AMD'>EPYC-Genoa</model>
      <model usable='yes' vendor='AMD'>EPYC</model>
      <model usable='yes' vendor='Hygon'>Dhyana</model>
      <model usable='no' vendor='Intel'>Cooperlake</model>
      <model usable='yes' vendor='Intel'>Conroe</model>
      <model usable='no' vendor='Intel'>Cascadelake-Server-noTSX</model>
      <model usable='no' vendor='Intel'>Cascadelake-Server</model>
      <model usable='yes' vendor='Intel'>Broadwell-noTSX-IBRS</model>
      <model usable='yes' vendor='Intel'>Broadwell-noTSX</model>
      <model usable='no' vendor='Intel'>Broadwell-IBRS</model>
      <model usable='no' vendor='Intel'>Broadwell</model>
      <model usable='yes' vendor='unknown'>486</model>
    </mode>
  </cpu>
  <memoryBacking supported='yes'>
    <enum name='sourceType'>
      <value>file</value>
      <value>anonymous</value>
      <value>memfd</value>
    </enum>
  </memoryBacking>
  <devices>
    <disk supported='yes'>
      <enum name='diskDevice'>
        <value>disk</value>
        <value>cdrom</value>
        <value>floppy</value>
        <value>lun</value>
      </enum>
      <enum name='bus'>
        <value>ide</value>
        <value>fdc</value>
        <value>scsi</value>
        <value>virtio</value>
        <value>usb</value>
        <value>sata</value>
      </enum>
      <enum name='model'>
        <value>virtio</value>
        <value>virtio-transitional</value>
        <value>virtio-non-transitional</value>
      </enum>
    </disk>
    <graphics supported='yes'>
      <enum name='type'>
        <value>sdl</value>
        <value>vnc</value>
        <value>spice</value>
        <value>egl-headless</value>
        <value>dbus</value>
      </enum>
    </graphics>
    <video supported='yes'>
      <enum name='modelType'>
        <value>vga</value>
        <value>cirrus</value>
        <value>vmvga</value>
        <value>qxl</value>
        <value>virtio</value>
        <value>none</value>
        <value>bochs</value>
        <value>ramfb</value>
      </enum>
    </video>
    <hostdev supported='yes'>
      <enum name='mode'>
        <value>subsystem</value>
      </enum>
      <enum name='startupPolicy'>
        <value>default</value>
        <value>mandatory</value>
        <value>requisite</value>
        <value>optional</value>
      </enum>
      <enum name='subsysType'>
        <value>usb</value>
        <value>pci</value>
        <value>scsi</value>
      </enum>
      <enum name='capsType'/>
      <enum name='pciBackend'>
        <value>default</value>
        <value>vfio</value>
      </enum>
    </hostdev>
    <rng supported='yes'>
      <enum name='model'>
        <value>virtio</value>
        <value>virtio-transitional</value>
        <value>virtio-non-transitional</value>
      </enum>
      <enum name='backendModel'>
        <value>random</value>
        <value>egd</value>
        <value>builtin</value>
      </enum>
    </rng>
    <filesystem supported='yes'>
      <enum name='driverType'>
        <value>path</value>
        <value>handle</value>
        <value>virtiofs</value>
      </enum>
    </filesystem>
    <tpm supported='yes'>
      <enum name='model'>
        <value>tpm-tis</value>
        <value>tpm-crb</value>
      </enum>
      <enum name='backendModel'>
        <value>passthrough</value>
        <value>emulator</value>
        <value>external</value>
      </enum>
      <enum name='backendVersion'>
        <value>1.2</value>
        <value>2.0</value>
      </enum>
    </tpm>
    <redirdev supported='yes'>
      <enum name='bus'>
        <value>usb</value>
      </enum>
    </redirdev>
    <channel supported='yes'>
      <enum name='type'>
        <value>pty</value>
        <value>unix</value>
        <value>spicevmc</value>
      </enum>
    </channel>
    <crypto supported='yes'>
      <enum name='model'>
        <value>virtio</value>
      </enum>
      <enum name='type'>
        <value>qemu</value>
      </enum>
      <enum name='backendModel'>
        <value>builtin</value>
        <value>lkcf</value>
      </enum>
    </crypto>
  </devices>
  <features>
    <gic supported='no'/>
    <vmcoreinfo supported='yes'/>
    <genid supported='yes'/>
    <backingStoreInput supported='yes'/>
    <backup supported='yes'/>
    <async-teardown supported='yes'/>
    <sev supported='no'/>
    <sgx supported='no'/>
    <hyperv supported='yes'>
      <enum name='features'>
        <value>relaxed</value>
        <value>vapic</value>
        <value>spinlocks</value>
        <value>vpindex</value>
        <value>runtime</value>
        <value>synic</value>
        <value>stimer</value>
        <value>reset</value>
        <value>vendor_id</value>
        <value>frequencies</value>
        <value>reenlightenment</value>
        <value>tlbflush</value>
        <value>ipi</value>
        <value>avic</value>
      </enum>
    </hyperv>
    <launchSecurity supported='yes'>
      <enum name='sectype'>
        <value>sev-snp</value>
      </enum>
    </launchSecurity>
  </features>
</domainCapabilities>
```

openEuler/libvirt关闭 .gitee-modal { width: 500px !important; }

搜索帮助

openEuler/libvirt
关闭